Representation learning-based network intrusion detection system by capturing explicit and implicit feature interactions

Wang, Wei; Jian, Songlei; Tan, Yusong; Wu, Qingbo; Huang, Chenlin

doi:10.1016/j.cose.2021.102537

Cited by 31 publications

(15 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It should be noted that the numerical flow features are not well considered in the above methods, either ignored or treated as categorical. RL-IDS [29] takes care of this issue. It only learns embeddings on categorical features with an unsupervised method FVRL and then integrates the embeddings and numerical features with a supervised method NNRL.…”

Section: Static Embedding-based Methodsmentioning

confidence: 99%

Interaction Context-Aware Network Behavior Anomaly Detection for Discovering Unknown Attacks

Qin

et al. 2022

Security and Communication Networks

View full text Add to dashboard Cite

Network behavior anomaly detection is an effective approach to discover unknown attacks, where generating high-efficacy network behavior representation is one of the most crucial parts. Nowadays, complicated network environments and advancing attack techniques make it more challenging. Existing methods cannot yield satisfied representations that express the semantics of network behaviors comprehensively. To tackle this problem, we propose XNBAD, a novel unsupervised network behavior anomaly detection framework, in this work. It integrates the timely high-order host states under the dynamic interaction context with the conversation patterns between hosts for behavior representation. High-order states can better summarize latent interaction patterns, but they are hard to be obtained directly. Therefore, XNBAD utilizes a graph neural network (GNN) to automatically generate high-order features from series of extracted base ones. We evaluated the detection performance of XNBAD in a publicly available benchmark dataset ISCX-2012. To report detailed and precise experimental results, we carefully refined the dataset before evaluation. The results show that XNBAD discovered various attack behaviors more effectively, and it significantly outperformed the existing representative methods by at least 3.8 % relative improvement in terms of the overall weighted AUC.

show abstract

Section: Static Embedding-based Methodsmentioning

confidence: 99%

Interaction Context-Aware Network Behavior Anomaly Detection for Discovering Unknown Attacks

Qin

et al. 2022

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…Network anomaly detection and intrusion detection are two important and heavily studied fields, and numerous combinations of techniques can be used to detect and mitigate attacks from a network [23] [24] [25] [26] [27]. On top of that, the software-defined networking (SDN) paradigm brings an evolution to network management and has been used as a flexible solution to manage heterogeneous networks [3].…”

Section: Related Workmentioning

confidence: 99%

A Gated Recurrent Unit Deep Learning Model to Detect and Mitigate Distributed Denial of Service and Portscan Attacks

et al. 2022

View full text Add to dashboard Cite

Nowadays, it is common for applications to require servers to run constantly and aim as close as possible to zero downtime. The slightest failure might cause significant financial losses and sometimes even lives. For this reason, security and management measures against network threats are fundamental and have been researched for years. Software-defined networks (SDN) are an advancement in network management due to their centralization of the control plane, as it facilitates equipment setup and administration over the local network. However, this centralization makes the controller a target to denial of service attacks (DoS). In this study, we aim to develop a network anomaly detection and mitigation system that uses gated recurrent unit (GRU) neural networks combined with fuzzy logic. The neural network is trained to forecast future traffic, and anomalies are detected when the forecasting fails. The system is designed to operate in software-defined networks since they provide network flow information and tools to manage forwarding tables. We also demonstrate how the neural network's hyperparameters affect the detection module. The system was tested using two datasets: one with emulated traffic generated by the data communication and networking research group called Orion, from computer science department at state university of Londrina, and CICDDoS2019, a well-known dataset by the anomaly detection community. The results show that GRU networks combined with fuzzy logic are a viable option to detect anomalies in SDN and possibly in other anomaly detection applications. We compared our model with other deep learning techniques.

show abstract

“…In [35] proposed the RL-NIDS that consists of two main modules, first learning module for unsupervised feature value representation that aims to explicitly learn feature interactions between categorical features, in the second module is supervised Neural Network for object Representation Learning which aims to learn the implicit interactions in the representation space. Accessible datasets inclusive of NSL-KDD and AWIDS were used to perform the experiment.…”

Section: Related Workmentioning

confidence: 99%

Cyber Intrusion Detection System Based on a Multiobjective Binary Bat Algorithm for Feature Selection and Enhanced Bat Algorithm for Parameter Optimization in Neural Networks

et al. 2022

View full text Add to dashboard Cite

The staggering development of cyber threats has propelled experts, professionals and specialists in the field of security into the development of more dependable protection systems, including effective intrusion detection system (IDS) mechanisms which are equipped for boosting accurately detected threats and limiting erroneously detected threats simultaneously. Nonetheless, the proficiency of the IDS framework depends essentially on extracted features from network traffic and an effective classifier of the traffic into abnormal or normal traffic. The prime impetus of this study is to increase the performance of the IDS on networks by building a two-phase framework to reinforce and subsequently enhance detection rate and diminish the rate of false alarm. The initial stage utilizes the developed algorithm of a proficient wrapperapproach-based feature selection which is created on a multi-objective BAT algorithm (MOBBAT). The subsequent stage utilizes the features obtained from the initial stage to categorize the traffic based on the newly upgraded BAT algorithm (EBAT) for training multilayer perceptron (EBATMLP), to improve the IDS performance. The resulting methodology is known as the (MOB-EBATMLP). The efficiency of our proposition has been assessed by utilizing the mainstream benchmarked datasets: NLS-KDD, ISCX2012, UNSW-NB15, KDD CUP 1999, and CICIDS2017 which are established as standard datasets for evaluating IDS. The outcome of our experimental analysis demonstrates a noteworthy advancement in network IDS above other techniques. INDEX TERMSIntrusion detection system (IDS), bat algorithm (BAT), metaheuristic algorithm (MA), feature selection (FS), multi-objective optimization (MOO), multilayer perceptron (MLP)

show abstract

Representation learning-based network intrusion detection system by capturing explicit and implicit feature interactions

Cited by 31 publications

References 30 publications

Interaction Context-Aware Network Behavior Anomaly Detection for Discovering Unknown Attacks

Interaction Context-Aware Network Behavior Anomaly Detection for Discovering Unknown Attacks

A Gated Recurrent Unit Deep Learning Model to Detect and Mitigate Distributed Denial of Service and Portscan Attacks

Cyber Intrusion Detection System Based on a Multiobjective Binary Bat Algorithm for Feature Selection and Enhanced Bat Algorithm for Parameter Optimization in Neural Networks

Contact Info

Product

Resources

About